Half of Threat Hunters Now Call Data Their Biggest Barrier, Overtaking Staffing for the First Time, New SANS Institute Survey Finds
Bethesda, MD, Sept. 23, 2026 (GLOBE NEWSWIRE) -- For years, a threat hunting program’s results depended largely on whether it had enough skilled people to run it. SANS Institute today released the SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting authored by Josh Lemon, SANS Principal Instructor, and this year’s data shows staffing is no longer the top concern it once was. The survey finds the same structural friction that has defined threat hunting since its first iteration, this time rooted in the data that hunters depend on rather than the people running the hunts.
The survey collected responses from 500 cybersecurity practitioners and security leaders across North America, Europe, Latin America, and Asia. The survey has tracked how organizations approach proactive threat detection since 2021.
Eighty-two percent of respondents have been hunting for at least two years. Despite that experience, 50% now name data quality or quantity as their primary barrier to effective hunting, the first time in the survey’s history that data has outranked skilled staff (45%) as the top obstacle. Cloud infrastructure is where the data problem hits hardest with 32% calling it the toughest environment to hunt in, more than any other area, even as organizations keep moving more of their infrastructure there.
“Data quality has overtaken skilled staff as the top barrier for the first time in this survey's history," said Josh Lemon, SANS Principal Instructor. “You can be the most capable hunter in the room and still come up empty if the telemetry you're working with is incomplete, inconsistent, or scattered across a dozen tools that are difficult to access or difficult to process. And with only 40% of programs formally measuring whether their hunting actually works, most organizations have no real way of knowing whether that gap is costing them.”
Additional key findings from the survey include:
- Living-off-the-land techniques dominate: 73% of respondents identify these techniques as the top method used by nation-state actors, and 63% say the same for organized crime. Malware-free, behavior-blending tradecraft is now the baseline hunters are expected to catch, no longer an exception to watch for.
- Defined methodologies are eroding: 37% of organizations now have a formally defined threat hunting methodology, down from 46% in 2025 and 51% in 2024, while ad hoc approaches have climbed back to 39%.
- Measurement is falling: Formal measurement of hunt outcomes has fallen to 40%, down from 64% in 2024, making it harder for programs to defend their budgets and existence.
- AI plans are getting more grounded: 39% rank AI/ML incorporation among their top planned improvements, down from 48% in 2025, a sign that hunters are testing AI against their own workflows rather than assuming it will close that data gap for them.
- Outsourcing continues declining: Outsourcing fell to 18% from 30% in 2025, while organizations keeping hunting in-house held steady at 58% for a second consecutive year.
The full SANS 2026 Threat Hunting Survey: The Evolution of Threat Hunting is free to download today at sans.org/white-papers/sans-2026-threat-hunting-survey-evolution-threat-hunting. Josh Lemon will present an accompanying webcast on Wednesday, September 23rd at 10:30 a.m. ET and a recording will be available after. Sign up for the webcast or view the recording at sans.org/webcasts/sans-2026-threat-hunting-survey.
About SANS
The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cybersecurity training and certification to professionals in government and commercial institutions worldwide. Renowned SANS instructors teach more than 85 courses at in-person and virtual cybersecurity events and OnDemand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 50 hands-on technical certifications in cybersecurity. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master’s and bachelor’s degrees, graduate certificates, and an undergraduate certificate in cybersecurity. SANS also delivers a wide variety of free resources to the InfoSec community, including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet's early warning system–the Internet Storm Center. At the heart of SANS are the many security practitioners representing varied global organizations, from corporations to universities, working together to support and educate the global information security community.
Jenn Elston SANS Institute 301-654-7267 press@sans.org
© Copyright Globe Newswire, Inc. All rights reserved. The information contained in this news report may not be published, broadcast or otherwise distributed without the prior written authority of Globe Newswire, Inc.
